Do not open a public issue for security vulnerabilities. Report privately instead:

• Use the private vulnerability reporting form on GitHub.

Please include:

• affected component and version
• steps to reproduce
• impact assessment, if known